Merge feature/multiprotocol: multi-protocol support

Adds SSH, Telnet, SMTP, RDP, FTP, SIP, SMB, MAIL honeypot support
with protocol switcher, per-protocol leaderboards, Proto Stats pane,
classic mode for single-protocol servers, and ?show= URL filtering.
Preserves blocklist features from master.

Author: djkurlander

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Overview
 
-Knock-Knock is an SSH honeypot monitoring system that captures unauthorized SSH login attempts and displays real-time attack data through a live web dashboard. It can be deployed via Docker or as two coordinated systemd services.
+Knock-Knock is a multi-protocol honeypot monitoring system that captures unauthorized login attempts on SSH (port 22), Telnet (port 23), and SMTP (port 587), and displays real-time attack data through a live web dashboard. It can be deployed via Docker or as two coordinated systemd services.
 
 ## Commands
 
@@ -32,10 +32,12 @@ docker compose logs -f
 ```bash
 source .venv/bin/activate
 
-# SSH honeypot (port 22)
-python honeypot.py
+# Individual honeypots (ports 22, 23, 587)
+python ssh_honeypot.py
+python telnet_honeypot.py
+python smtp_honeypot.py
 
-# Log monitor + geo-enricher — spawns honeypot.py as a subprocess
+# Log monitor + geo-enricher — spawns all three honeypots as subprocesses
 # Add --save-knocks to store individual knocks in SQLite
 python monitor.py
 
@@ -64,43 +66,55 @@ sqlite3 data/knock_knock.db "SELECT * FROM knocks ORDER BY id DESC LIMIT 10;"
 
 # Redis connectivity
 redis-cli ping
+
+# Check per-protocol feed lists
+redis-cli llen knock:recent:ssh
+redis-cli llen knock:recent:tnet
+redis-cli llen knock:recent:smtp
+
+# Watch for SMTP connections (even without AUTH — honeypot logs every connect)
+journalctl -u knock-monitor -f | grep SMTP
 ```
 
 ## Architecture
 
 ```
-SSH Attacker → honeypot.py (port 22) → stdout
-                                              ↓
-                                       monitor.py (spawns honeypot, parses output, GeoIP lookup)
-                                              ↓
-                                    SQLite DB (data/) + Redis pub/sub
-                                              ↓
-                                       main.py (FastAPI, port 80/443)
-                                              ↓
-                                    Browser WebSocket → Live Dashboard
+SSH Attacker  → ssh_honeypot.py  (port 22)  ─┐
+Telnet Attacker → telnet_honeypot.py (port 23) ─┼→ stdout → monitor.py
+SMTP Attacker → smtp_honeypot.py (port 587) ─┘        (GeoIP, DB, Redis)
+                                                              ↓
+                                                  SQLite DB (data/) + Redis pub/sub
+                                                              ↓
+                                                   main.py (FastAPI, port 80/443)
+                                                              ↓
+                                               Browser WebSocket → Live Dashboard
 ```
 
 **Two Services:**
-- `honeypot.py` + `monitor.py`: Combined into a single systemd unit. Monitor spawns honeypot as a subprocess and reads its stdout. Performs GeoIP lookups, updates intel tables in SQLite, publishes to Redis. Individual knocks are only saved to SQLite with `--save-knocks`. Honeypot checks `knock:blocked` Redis set on each connection to reject blocked IPs instantly.
-- `main.py`: FastAPI server with WebSocket endpoint `/ws`, subscribes to Redis, broadcasts to all connected browsers
+- `monitor.py`: Spawns all three honeypots as subprocesses, merges their stdout via a shared `queue.Queue`, performs GeoIP lookups, updates SQLite intel tables, publishes to Redis. Individual knocks saved to SQLite only with `--save-knocks`. Honeypots check `knock:blocked` Redis set on each connection to reject blocked IPs instantly.
+- `main.py`: FastAPI server with WebSocket endpoint `/ws`, subscribes to Redis, broadcasts to all connected browsers.
 
 **Data Flow:**
-- Monitor spawns honeypot as a subprocess and reads its stdout (both systemd and Docker)
+- Monitor spawns honeypots as subprocesses and reads their stdout (both systemd and Docker)
+- Each honeypot emits JSON: `{"type": "KNOCK", "proto": "SSH"|"TNET"|"SMTP", "ip": ..., "user": ..., "pass": ...}`
 - Inter-service communication via Redis pub/sub channel `radiation_stream`
-- Stats cached in memory (10-min refresh), periodic sync every 60 seconds
+- Stats cached in memory, refreshed every 60 seconds and broadcast to all clients
 - SQLite databases in `data/` directory for persistence
 
 **Deployment modes:**
-- **Docker:** `docker compose up -d` — monitor spawns honeypot internally
-- **Systemd:** Two unit files in `systemd/` — monitor spawns honeypot internally
+- **Docker:** `docker compose up -d` — monitor spawns all honeypots internally
+- **Systemd:** Two unit files in `systemd/` — monitor spawns all honeypots internally
 
 ## Key Files
 
 | File | Purpose |
 |------|---------|
-| `honeypot.py` | SSH honeypot with `SSHHoneypot` class |
-| `monitor.py` | Log parser, GeoIP enrichment, DB writes, Redis publish |
+| `ssh_honeypot.py` | SSH honeypot (port 22) using paramiko |
+| `telnet_honeypot.py` | Telnet honeypot (port 23), raw socket with IAC negotiation |
+| `smtp_honeypot.py` | SMTP honeypot (port 587), AUTH LOGIN + AUTH PLAIN |
+| `monitor.py` | Spawns honeypots, GeoIP enrichment, DB writes, Redis publish |
 | `main.py` | FastAPI server, `ConnectionManager`, `GlobalStatsCache`, WebSocket |
+| `constants.py` | Shared protocol enum: `PROTO` dict and `PROTO_NAME` reverse lookup |
 | `index.html` | Single-page dashboard with WebSocket client |
 | `restart.sh` | Service orchestration (systemd and Docker) |
 | `Dockerfile` | Single image for honeypot-monitor and web containers |
@@ -126,50 +140,78 @@ All persistent data lives in `data/`:
 | `ENABLE_SSL` | unset | Set to `true` in `docker-compose.yml` for HTTPS |
 | `LOG_VISITORS` | unset | Set to `true` to log dashboard visitors to `visitors.db` |
 
+## Protocol Enum
+
+Defined in `constants.py`, imported by both `monitor.py` and `main.py`:
+
+```python
+PROTO = {'SSH': 0, 'TNET': 1, 'SMTP': 2, 'RDP': 3}
+PROTO_NAME = {v: k for k, v in PROTO.items()}
+```
+
 ## Database Schema
 
 ```sql
 -- Main attack log (only populated with --save-knocks)
-knocks(id, timestamp, ip_address, iso_code, city, region, country, isp, asn, username, password)
-
--- Intelligence tables (aggregated counts with indexed hits for fast top-N queries)
-user_intel(username PRIMARY KEY, hits, last_seen)     -- INDEX on hits DESC
-pass_intel(password PRIMARY KEY, hits, last_seen)     -- INDEX on hits DESC
-country_intel(iso_code PRIMARY KEY, country, hits, last_seen)  -- INDEX on hits DESC
-isp_intel(isp PRIMARY KEY, hits, last_seen, asn)       -- INDEX on hits DESC
-ip_intel(ip PRIMARY KEY, hits, last_seen, lat, lng)   -- INDEX on hits DESC, stores coordinates
+knocks(id, timestamp, ip_address, iso_code, city, region, country, isp, asn, username, password, proto INTEGER)
+
+-- ALL intel tables (aggregated counts, indexed hits for fast top-N queries)
+user_intel(username PRIMARY KEY, hits, last_seen)               -- INDEX on hits DESC
+pass_intel(password PRIMARY KEY, hits, last_seen)               -- INDEX on hits DESC
+country_intel(iso_code PRIMARY KEY, country, hits, last_seen)   -- INDEX on hits DESC
+isp_intel(isp PRIMARY KEY, hits, last_seen, asn)                -- INDEX on hits DESC
+ip_intel(ip PRIMARY KEY, hits, last_seen, lat, lng)             -- INDEX on hits DESC
+
+-- Per-protocol intel tables (same structure, composite PK)
+user_intel_proto(username, proto INTEGER, hits, last_seen)      -- INDEX on (proto, hits DESC)
+pass_intel_proto(password, proto INTEGER, hits, last_seen)      -- INDEX on (proto, hits DESC)
+country_intel_proto(iso_code, proto INTEGER, country, hits, last_seen)
+isp_intel_proto(isp, proto INTEGER, hits, last_seen, asn)
+ip_intel_proto(ip, proto INTEGER, hits, last_seen, lat, lng)
 
 -- Uptime tracking for KPM calculation
-monitor_heartbeats(id, timestamp)
+monitor_heartbeats(id, uptime_minutes)
 ```
 
-Intel tables are updated on each knock via `INSERT ... ON CONFLICT DO UPDATE`. Top-N queries use the hits index (~100 rows) instead of GROUP BY on knocks (all rows).
-
-## External Dependencies
-
-- Redis server (localhost:6379 or via `REDIS_HOST` env var)
-- GeoIP databases at `/usr/share/GeoIP/GeoLite2-{City,ASN}.mmdb`
-- SSL certificates in `certs/` directory (optional, for HTTPS)
-- Python 3.12 with `uv` virtual environment (systemd) or Docker
+Each knock writes 10 upserts: 5 to ALL tables + 5 to `_proto` tables. ALL tables serve as fast rollup for the ALL leaderboard; `_proto` tables serve per-protocol leaderboards.
 
 ## Redis Keys
 
-- `knock:total_global` - Total attack count
+- `knock:total_global` - Total attack count (all protocols)
+- `knock:uptime_minutes` - Monitor uptime in minutes
 - `knock:last_time` - Unix timestamp of last knock
 - `knock:last_lat` - Latitude of last knock location
 - `knock:last_lng` - Longitude of last knock location
-- `knock:recent` - Last 100 knocks (JSON list, used for initial page load)
+- `knock:recent` - Last 100 knocks, all protocols (JSON list)
+- `knock:recent:ssh` - Last 100 SSH knocks
+- `knock:recent:tnet` - Last 100 Telnet knocks
+- `knock:recent:smtp` - Last 100 SMTP knocks
 - `knock:blocked` - Set of blocked IPs (seeded from `blocklist.txt` on startup; checked by honeypot on each connection)
 - `radiation_stream` - Pub/sub channel for real-time events
 
+## Globe Rendering Rules
+
+The pane globes are paused when idle (`pauseAnimation()`). **Any change to globe scene state (polygon data, point data, styles) will NOT be visible until the animation loop runs a frame.** Always follow scene changes with:
+```javascript
+if (paneGlobeDesktop && paneGlobeVisible.desktop) paneGlobeDesktop.resumeAnimation();
+if (paneGlobeMobile && paneGlobeVisible.mobile) paneGlobeMobile.resumeAnimation();
+schedulePaneGlobePause();
+```
+`refreshHeatGlobe()` and `applyGlobeStyle()` already do this. Any new function that modifies pane globe state must too.
+
+Additionally, `polygonsData(sameRef)` may be short-circuited by globe.gl — always pass `[...countriesData]` to guarantee the polygon digest runs and accessor functions are re-evaluated.
+
 ## Frontend Features
 
-- **3D Globe** (globe.gl): Displays attack location, rotates on new knocks; includes heat map mode
-- **Live Feed**: Real-time attack log with username/password/location
-- **Leaderboards**: Top countries, usernames, passwords, ISPs, IPs
+- **3D Globe** (globe.gl): Displays attack location, rotates on new knocks; heat map mode extrudes countries by hit count
+- **Protocol Filter**: Cycles ALL → SSH → TNET → SMTP → ALL; filters live feed, leaderboards, globe rotation, and heat map
+- **Live Feed**: Real-time attack log with protocol badge, username/password/location
+- **Leaderboards**: Top countries, usernames, passwords, ISPs, IPs — per-protocol or ALL
 - **Trivia & Jokes**: Context about why usernames/passwords are chosen, plus knock-knock jokes
 - **Sound Effects**: Optional audio notifications for new knocks
 - **About**: Project info section
+- **Classic Mode**: Automatically activates when only one protocol is active — hides protocol switcher, cycle buttons, proto badges, proto chip pulses, and Proto Stats pane for a clean single-protocol UI. Header label changes from "Total Knocks" to "[PROTO] Knocks"
+- **`?show` URL Parameter**: Subset which protocols are visible (e.g., `?show=SSH`, `?show=SSH,RDP`). Intersected with server's enabled protocols; invalid values fall back to all enabled. Single-protocol `?show` triggers classic mode. When filtered, header stats (total, KPM, ago) reflect only the active protocols, computed client-side from `protoBreakdownCache` and `lastKnockTimeByProto`
 - **Debug Mode**: Overlay via `?debug` URL parameter
 - **Responsive**: Mobile carousel with swipe navigation, desktop grid layout
 - **WebSocket**: Auto-reconnect, live updates without polling

Dockerfile

@@ -2,12 +2,13 @@ FROM python:3.12-slim
 
 RUN pip install --no-cache-dir \
     paramiko \
+    impacket \
     geoip2 \
     redis \
     fastapi \
     "uvicorn[standard]"
 
 WORKDIR /app
-COPY honeypot.py monitor.py main.py index.html ./
+COPY monitor.py main.py constants.py index.html ./
+COPY honeypots/ honeypots/
 COPY static/ static/
-RUN python -c "import paramiko; paramiko.RSAKey.generate(2048).write_private_key_file('server.key')"

INSTALL.md

@@ -93,7 +93,7 @@ docker compose logs -f honeypot-monitor
 # Should show:
 #   ⏳ Waiting for GeoIP databases...  (briefly, during first-time download)
 #   ✅ GeoIP databases loaded
-#   🚀 Maximalist Monitor Active...
+#   🚀 Knock-Knock Monitor Active...
 
 docker compose logs web   # Should show uvicorn startup
 ```

MERGE_PLAN.md

@@ -0,0 +1,74 @@
+# Merge Strategy: Master vs Feature/Multiprotocol
+
+## Context
+
+knock-knock.net (master) runs an SSH-only honeypot with a clean, focused UI — 11 panes, ~1,800 lines of frontend code. beta.knock-knock.net (feature/multiprotocol) extends this to 8 protocols (SSH, Telnet, SMTP, RDP, MAIL, FTP, SIP, SMB) with protocol cycling buttons, per-protocol leaderboards, protocol badges, and a Proto Stats pane — 12 panes, ~2,800 lines of frontend. The feature branch is 54 commits ahead; master has 0 commits not in feature (clean fast-forward).
+
+The dilemma: the simple UI is elegant, the multiprotocol data is valuable, and maintaining two divergent codebases is unsustainable for a solo developer.
+
+## Recommendation: Merge + Auto-Detecting Classic Mode
+
+**Insight:** The multiprotocol frontend *already works identically to the classic view* when the protocol filter is on "ALL." The only visual differences are protocol cycle buttons, the Proto Stats pane, and protocol badges in the feed. When only one protocol is enabled, those elements are meaningless — so hide them automatically.
+
+**The rule:** The frontend already receives `enabled_protocols` from the server on WebSocket connect. If `enabled_protocols.length === 1`, apply classic mode. If `> 1`, show the full multiprotocol UI. No toggles, no URL params, no user decisions — the UI adapts to the server config.
+
+## Implementation
+
+### Step 1: Merge feature/multiprotocol into master
+```bash
+git checkout master
+git merge --ff-only feature/multiprotocol
+```
+
+### Step 2: Add auto-detecting classic mode (~25 lines in index.html)
+
+**CSS (~10 lines):**
+```css
+body.classic-mode .proto-cycle-btn { display: none !important; }
+body.classic-mode #d-box-proto { display: none !important; }
+body.classic-mode #m-pane-proto { display: none !important; }
+body.classic-mode .proto-badge { display: none !important; }
+/* Hide Proto Stats nav items in both desktop and mobile nav */
+```
+
+**JS (~15 lines):**
+In the WebSocket `init_stats` handler (where `enabled_protocols` is already received):
+```javascript
+// Auto-detect classic mode based on server config
+const classicMode = (data.enabled_protocols || []).length <= 1;
+document.body.classList.toggle('classic-mode', classicMode);
+// Adjust pane count for mobile dots / desktop nav if needed
+```
+
+No localStorage, no toggle button, no URL params. Pure server-driven.
+
+### Step 3: Adjust navigation pane counts
+
+When classic mode is active, the Proto Stats pane is hidden. The desktop nav and mobile dot indicators need to account for this:
+- Desktop: hide the Proto Stats nav item (CSS handles this)
+- Mobile: hide the corresponding dot and adjust swipe/snap behavior
+- `dJump()` / mobile pane index may need a small guard if Proto Stats pane index is referenced
+
+## Why this wins
+
+1. **Zero code duplication** — one index.html, one backend, one branch
+2. **Zero configuration** — no toggles, no URL params; UI auto-adapts
+3. **Correct by construction** — single-protocol deployments get a clean UI because the protocol UI *has nothing to show*
+4. **Fast-forward merge** — no conflicts, all 54 commits ship to production
+5. **Trivial implementation** — ~25 lines of CSS+JS
+6. **Zero maintenance overhead** — every future fix applies to both modes automatically
+
+## Files to Modify
+
+| File | Change |
+|------|--------|
+| `index.html` | ~10 lines CSS for `.classic-mode` rules, ~15 lines JS for auto-detection in `init_stats` handler |
+| No backend changes | main.py, monitor.py, constants.py already complete on feature branch |
+
+## Verification
+
+1. Merge: `git checkout master && git merge --ff-only feature/multiprotocol`
+2. Multi-protocol test: deploy with multiple protocols enabled → confirm full UI (cycle buttons, Proto Stats, badges all visible)
+3. Single-protocol test: set `ENABLED_PROTOCOLS=SSH` in env → restart monitor → reload page → confirm classic mode (no cycle buttons, no Proto Stats pane, no protocol badges)
+4. Mobile: confirm Proto Stats nav dot hidden in classic mode, swipe navigation still works correctly
+5. Verify leaderboards still aggregate correctly in both modes

README.md

@@ -63,7 +63,7 @@ Knock-Knock supports three different installation methods, with docker being the
 ```
 SSH Attacker
   ↓
-honeypot.py (port 22)
+ssh_honeypot.py (port 22)
   ↓
 monitor.py (GeoIP lookup)
   ↓

constants.py

@@ -0,0 +1,79 @@
+# Protocol enum — stored as INTEGER in knocks/proto intel tables
+PROTO = {'SSH': 0, 'TNET': 1, 'SMTP': 2, 'RDP': 3, 'MAIL': 4, 'FTP': 5, 'SIP': 6, 'SMB': 7}
+PROTO_NAME = {v: k for k, v in PROTO.items()}  # reverse lookup: 0->'SSH' etc.
+
+# Canonical protocol order for UI controls and displays.
+PROTOCOL_UI_ORDER = ['SSH', 'TNET', 'FTP', 'RDP', 'SMB', 'SIP', 'SMTP', 'MAIL']
+
+# Declarative protocol metadata for monitor/web UI.
+PROTOCOL_META = {
+    'SSH': {
+        'proto_int': 0,
+        'color': '#00ff41',
+        'supports_user_panel': True,
+        'supports_pass_panel': True,
+        'honeypot_script': 'honeypots/ssh_honeypot.py',
+    },
+    'TNET': {
+        'proto_int': 1,
+        'color': '#00fbff',
+        'supports_user_panel': True,
+        'supports_pass_panel': True,
+        'honeypot_script': 'honeypots/telnet_honeypot.py',
+    },
+    'SMTP': {
+        'proto_int': 2,
+        'color': '#ff00ff',
+        'supports_user_panel': True,
+        'supports_pass_panel': True,
+        'honeypot_script': 'honeypots/smtp_honeypot.py',
+    },
+    'RDP': {
+        'proto_int': 3,
+        'color': '#ff1a1a',
+        'supports_user_panel': True,
+        'supports_pass_panel': False,
+        'honeypot_script': 'honeypots/rdp_honeypot.py',
+    },
+    'MAIL': {
+        'proto_int': 4,
+        'color': '#00ffaa',
+        'supports_user_panel': False,
+        'supports_pass_panel': False,
+        'honeypot_script': 'honeypots/smtp25_honeypot.py',
+    },
+    'FTP': {
+        'proto_int': 5,
+        'color': '#FFFF77',
+        'supports_user_panel': True,
+        'supports_pass_panel': True,
+        'honeypot_script': 'honeypots/ftp_honeypot.py',
+    },
+    'SIP': {
+        'proto_int': 6,
+        'color': '#ff7a00',
+        'supports_user_panel': False,
+        'supports_pass_panel': False,
+        'honeypot_script': 'honeypots/sip_honeypot.py',
+    },
+    'SMB': {
+        'proto_int': 7,
+        'color': '#d6d9df',
+        'supports_user_panel': True,
+        'supports_pass_panel': False,
+        'honeypot_script': 'honeypots/smb_honeypot.py',
+    },
+}
+
+def sort_protocols_for_ui(protocols):
+    normalized = [str(p or '').upper() for p in (protocols or [])]
+    unique = []
+    for name in normalized:
+        if name in PROTO and name not in unique:
+            unique.append(name)
+    preferred = [name for name in PROTOCOL_UI_ORDER if name in unique]
+    extras = sorted([name for name in unique if name not in preferred])
+    return preferred + extras
+
+
+DEFAULT_ENABLED_PROTOCOLS = list(PROTOCOL_UI_ORDER)